Description
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References (8)
Core 8
Core References
Signature, Permissions Required signature
permissions-required
VDB-374552 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/374552/cti
Third Party Advisory third-party-advisory
CVE-2026-13544 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-13544
Third Party Advisory third-party-advisory
Submit #842582 | liufee cms 2.1.1 Information Disclosure
https://vuldb.com/submit/842582
Third Party Advisory third-party-advisory
Submit #842595 | liufee cms 2.1.1 Improper Privilege Management (Duplicate)
https://vuldb.com/submit/842595
Third Party Advisory third-party-advisory
Submit #842602 | liufee cms 2.1.1 Authorization Bypass (Duplicate)
https://vuldb.com/submit/842602
Issue Tracking issue-tracking
https://github.com/liufee/cms/issues/88
Exploit exploit
issue-tracking
https://github.com/liufee/cms/issues/89
Scores
CVSS v3
6.3
EPSS
0.0021
EPSS Percentile
12.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-266
CWE-284
Status
published
Products (2)
Feehi/CMS
2.1.0
Feehi/CMS
2.1.1
Published
Jun 29, 2026
Tracked Since
Jun 29, 2026